Piwigo Facetag 0.0.3 - SQL Injection [CVE-2017-9426] скачать в хорошем качестве

Piwigo Facetag 0.0.3 - SQL Injection [CVE-2017-9426]

What is Piwigo ? Piwigo is photo gallery software for the web, built by an active community of users and developers.Extensions make Piwigo easily customizable. Icing on the cake, Piwigo is free and open source. Facetag Extension in piwigo. This plugin extends piwigo with the function to tag faces in pictures. It adds an additional button on photo pages that let you tag a face on the picture. Piwigo's Facetag Extention have multiple SQL injection. Facetag Extention provide additional button on photo page for visitor or user to tag any name oh that image. Affected Method : 1) facetag.changeTag 2) facetag.listTags 1) facetag.changeTag ===When we gave any tag name to photo, That time our request send by POST method to server and directly interpret in server's database.Our POST request contain some perameter like (id,imageId,name etc) Affected parameter: imageId= 2) facetag.listTags ===When we visit any image on server. facetag.listTags method pass on ws.php file with imageId= parameter and fetch facetag name in json format. Affectd parameter : imageId= NOTE : "www.test.touhid" this domain not registed on internet. This domain host in touhid's local machine. *----------------------------*------------------------------------* Website :http://touhidshaikh.com Blog : http://touhidshaikh.com/blog/ Github : https://github.com/touhidshaikh Youtube :    / @writeupdb_academy   Google+ : https://plus.google.com/1116894234705... Facebook : www.facebook.com/tauheeds1 *----------------------------*------------------------------------*